DEFCON 2021 - Smart Meter Hacking - ICS Village

[@rosscrichton8277]

Just had to say, these videos are fantastic. I have always been interested in smart meters, here in the UK they are trying to make them mandatory.

[@wolu9456]

how many pot growers have been busted? f'in smartmeters

[@In3xorable]

Enjoyed the information. Videos like this are extremely interesting to me. Good job with editing as well.

[@Texas1FlyBoy]

Time to pull out my gear and have some fun! Thanks for the incentive. Great videos!

[@danskifpv]

Fantastic talk, thank you so much for this. I'm now 100% engrossed in your channel

[@RECESSIM]

Thanks! If you have questions or suggestions based on what you see let me know.

[@migueltacopocalypse5700]

Wonderful delivery and content. Love ur curiosity.

[@cemaxecuter7783]

Awesome! Great talk and super cool results on the map.

[@tisme1105]

It's one of the last things you mentioned which is the #1 reason I will resist having a meter like this as long as possible. Remote shutoff. I assume a remote command like this would have to the signed by RSA or similar, but if the signing code/cert/code is leaked, stolen - or there is a vulnerability in the smart meter code, an attacker could cut off homes/businesses on a large scale. That's bad. Very bad.

[@i_want_pizza7576]

then you take out the meter and bridge the contacts

[@jazb4317]

@recessim were you able to determine exactly what data was being transmitted regarding power usage/consumption and resolution (sample rate) of transmitted data? I have been particularly interested in the resolution of the data. I have wondered for example if they are simply capturing total kwh every 5 second intervals and transmitting it. Or are they also transmitting actual load in near real time. I see the meters supposedly report consumption and export. I'm just really curious to see what that meter is reporting and at what resolution the data is captured at. Is it super high res (like 1 second or less), or aggregated usage over larger samples like 5 or 10 minutes?

[@iammetaldave]

Fascinating video and information, Sir! It's a rabbit hole of investigating potential. On a side note, your t-shirts are excellent! :-)

[@RECESSIM]

Appreciate that! Currently working on glitching the processor to dump the firmware. As you say, so many fun things to try!

[@stockalerter6922]

Came from TikTok glad I’m here. I usually do stagelighting and 4G enabled hobby planes but I’m glad I’m here

[@RECESSIM]

Working on lighting right now so I can shoot some video in my garage

[@stockalerter6922]

@@RECESSIM haha I mean like search up ROBE BMFL on KZbin and you will see what I mean

[@RECESSIM]

@@stockalerter6922 haha, mine won’t be THAT epic!

[@stockalerter6922]

@@RECESSIM yeah there good. But not good when the lamp life is around 400 hours. And if you don’t replace it within time your in danger of it exploding and taking out the effects

[@technovelle]

you are what makes youtube great

[@adrianvalbuena8158]

Level and respect!.

[@Uneke]

I remember Sammy Kamkar, reverse engineering the girl talk Im-Me and having it run a script to open every garage door within the vicinity lol These off the shelf chips are so well documented that there is no practical way of implementing them very securely. And that’s scary when these companies are data mining your day to day habits.

[@RECESSIM]

They do a good job of pushing the chips capabilities, but on a long enough timeline everything gives up the secrets! Thanks for watching.

[@node00x18]

the right to know is not a crime, fellas

[@RECESSIM]

Amazing the level of conditioning people have been through, no one thinks you actually own or can modify anything that’s YOURS anymore 😳

[@node00x18]

@@RECESSIM , absolutely agree with you

[@node00x18]

The right to know is the force behind every discovery and achievement of the humanity

[@rhondawalnoha9352]

Mother Necessity

[@zyxwvutsrqponmlkh]

17:35 If an RTL-SDR is too expensive for you there are some hacked usb tv tuners that work for ~$8 that also work. Jokes aside all I really want is some software that's easy to use to read log my power usage in real time.

[@RECESSIM]

Me too! Lots of people over on the Discord channel analyzing the protocol.

[@wolu9456]

"ZigBee/Home Area Network (HAN) Functionality With the Gridstream RF G5 FOCUS AXe module, Landis+Gyr has the ZigBee radio platform for Gridstream RF which gives a utility the ability to increase consumer awareness of energy consump- tion and encourage personal responsibility for curbing the energy load. ZigBee released a Smart Energy Profile (SEP) application in early 2008 and it is quickly becoming a standard for communi- cating between energy management devices as part of a home area network (HAN). The ZigBee radio is located on the Gridstream RF AXe module creating an Energy Service Interface (ESI) that manages the bi-directional communication with ZigBee radio-based devices such as in-home dis- plays, smart thermostats and direct load control devices." i'm just copy and pasting fcc

[@Conner234]

I have an emh(eBZD type smart meter. I'm missing the pin, how can I brute force it ?

[@TymexComputing]

I think this is intro preludium :) where can we buy this t-shirt :)

[@nickbur1799]

Thanks for sharing. Can you add a link in the video description? Wondering if you are able to access the power usage information

[@RECESSIM]

Good call, added some links to the description. Thanks for watching.

[@nickbur1799]

@@RECESSIM thanks!

[@mathbee]

Where can I get a faraday cage like that? Also I'm a gnu radio fan living in Dallas

[@RECESSIM]

Search eBay for them, this is a Ramsey STE3000 I found on there. Check out Dallas Hackers Association monthly meetup, I’m usually out there.

[@suzyq7433]

I have been hearing smart meters are not good due to EMF & also we are being spied on through them somehow. Is there any truth to this? I’m in Michigan & opt out on this meter but discovered they snuck on my property & put one up anyway!

[@RECESSIM]

I haven't looked at them from a health perspective but they use the same RF technology as everything else (Computers, Cell Phones, WiFi, Bluetooth headsets) we use so I personally don't worry about it. As for spying on what you use and the general cyber security of them, that I am concerned about and analyzing.

[@suzyq7433]

@@RECESSIM Thank you for your reply. I find your videos very interesting!

[@RECESSIM]

@@suzyq7433 thanks a lot for the feedback!

[@i_want_pizza7576]

@@RECESSIM it's called load profile and usually shows in 15 minute chunks how much power you use plus other stuff. they're not at the point yet to tell which appliances you run but will be soon.

[@paulaoyedele2081]

Recently, my kilowatt usage went up by 300 extra unaccounted for kilowatts. Can this be achieved by a service provider?

[@RECESSIM]

Well the service provider could change values within the meter that determine how it calculated usage. But would be strange for them to do that only for a while and turn it back.

[@wolu9456]

"[Time of Use] (TOU) / Recorder 5-minute interval data is available for a maximum of 45 days for two channels"

[@i_want_pizza7576]

i heard smart meters are more accurate and when you get one don't be surprised if your cost goes up

[@williamvaughan1218]

If only we could buy a device to view our real time usage. That would be cool. Maby using the infared port?

[@RECESSIM]

I need to look at the RF side again, their method for sending power has evaded our attempts to understand it… so far

[@i_want_pizza7576]

you can often find an IR LED that pulses every so many watt hours. it's the equivalent of the black stripe on the disk from the old-school meters.

[@rastanator-]

where do you get your devices? are they not being owned by energy provider?

[@juliet0001]

surprisingly, you can get new ones on eBay.

[@zacharygonzales2543]

can u show me how I can help my bills out thanks

[@SpacePortArcade]

Are you going to the conference in September?

[@RECESSIM]

If you're talking about GRCon, yea... events.gnuradio.org/event/8/abstracts/44/

[@nekotherion7317]

This looks like DMR , on an ISM band

[@RECESSIM]

It’s FSK which is pretty familiar for low data rate stuff I think.

[@nekotherion7317]

@@RECESSIM DMR uses 4FSK, does mac addrs, and CRC, and more, and uses CC as color codes for isolating specific types of traffic, and in some circumstances can do FHSS if modified, so if i had to guess there taking DMR as a base, and modifying it slightly, look at MMDVM boards and pihats, some work in the 800~900mhz band iirc

[@nekotherion7317]

They even sell some DMR gateways as SCADA RF > Ethernet gateways, very similar tech, and can even handle IP traffic to a degree, for VoIP, as DMR is AMBE vocorder, 4fsk for RF layer, and then IP traffic as well